dcrat | 180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Size 1.9MB
Sample240522-xqew2ada78
SHA256 180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d
MD5 880b2950be17aca18aebdf116b26379b
SHA1 74c73e588de5a14a2c614c8a8d1f71c3e8ffdb54
SHA512 0c571f1e4ce7a3e887b55d7773453c910b3e2c5ee5eedf0d4a53a88d6b97f85114e8837794aa4ae6f2f600bdf5fde2374ffbc16b66bedcdda34379d530f3a967
SSDEEP 24576:ZcIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:3rhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ModemLogs\\Registry.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\ModemLogs\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IdentityCRL\\production\\lsass.exe\", \"C:\\Users\\Default\\Documents\\sppsvc.exe\", \"C:\\Users\\Default User\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\", \"C:\\Windows\\ShellComponents\\Idle.exe\", \"C:\\Users\\Default\\PrintHood\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	688	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	688	schtasks.exe	84

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1880-1-0x0000000000980000-0x0000000000B7A000-memory.dmp	dcrat
behavioral2/files/0x00070000000234b0-33.dat	dcrat
behavioral2/files/0x000b0000000234e3-182.dat	dcrat
behavioral2/files/0x00090000000234da-192.dat	dcrat

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/1880-7-0x0000000002CA0000-0x0000000002CB0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1880-14-0x000000001BEB0000-0x000000001BEBC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1880-16-0x000000001BFC0000-0x000000001BFCC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1880-20-0x000000001C0F0000-0x000000001C0FC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1880-21-0x000000001C100000-0x000000001C10A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3764	powershell.exe
452	powershell.exe
536	powershell.exe
3504	powershell.exe
668	powershell.exe
5052	powershell.exe
784	powershell.exe
3548	powershell.exe
4936	powershell.exe
800	powershell.exe
1192	powershell.exe
3116	powershell.exe
1128	powershell.exe
1648	powershell.exe
5028	powershell.exe
2716	powershell.exe
1860	powershell.exe
4676	powershell.exe
4844	powershell.exe
552	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Executes dropped EXE 1 IoCs

pid	Process
5700	dllhost.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default User\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default User\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\ShellComponents\\Idle.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\SearchApp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\PrintHood\\wininit.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Desktop\\smss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\ModemLogs\\Registry.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\ModemLogs\\Registry.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\IdentityCRL\\production\\lsass.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Documents\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\PrintHood\\wininit.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Documents\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\unsecapp.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\dllhost.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\IdentityCRL\\production\\lsass.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Desktop\\smss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\csrss.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\ShellComponents\\Idle.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\sppsvc.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\services.exe\""	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\es-ES\29c1c3cc0f7685	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX642C.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX6C3F.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\886983d96e3d3e	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX6E44.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX78D8.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RuntimeBroker.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCX838B.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\RCX7EE6.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\9e8d7a4ca61bd9	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX6631.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files\WindowsPowerShell\RuntimeBroker.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\0a1fd5f707cd16	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\38384e6a620884	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\c5b4cb5e9653cc	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Program Files\WindowsPowerShell\9e8d7a4ca61bd9	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX74CE.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IdentityCRL\production\lsass.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ShellComponents\Idle.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ModemLogs\Registry.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ModemLogs\RCX8177.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\IdentityCRL\production\lsass.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ShellComponents\6ccacd8608530f	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Favorites\5940a34987c991	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ModemLogs\Registry.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\IdentityCRL\production\6203df4a6bafc7	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\ModemLogs\ee2ad38f3d4382	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX5DFF.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ShellComponents\RCX7048.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ShellComponents\Idle.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Favorites\RCX7ADC.tmp	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
File created	C:\Windows\WaaS\tasks\dllhost.exe	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4700	schtasks.exe
3672	schtasks.exe
3764	schtasks.exe
2256	schtasks.exe
1676	schtasks.exe
3812	schtasks.exe
1392	schtasks.exe
2224	schtasks.exe
3568	schtasks.exe
1516	schtasks.exe
1940	schtasks.exe
820	schtasks.exe
5080	schtasks.exe
848	schtasks.exe
3136	schtasks.exe
4852	schtasks.exe
4676	schtasks.exe
2664	schtasks.exe
5056	schtasks.exe
1732	schtasks.exe
1868	schtasks.exe
3656	schtasks.exe
1860	schtasks.exe
4084	schtasks.exe
2072	schtasks.exe
3444	schtasks.exe
2620	schtasks.exe
3004	schtasks.exe
2908	schtasks.exe
2512	schtasks.exe
468	schtasks.exe
1124	schtasks.exe
3116	schtasks.exe
2104	schtasks.exe
1240	schtasks.exe
3132	schtasks.exe
3532	schtasks.exe
4364	schtasks.exe
3908	schtasks.exe
2164	schtasks.exe
1128	schtasks.exe
1724	schtasks.exe
3452	schtasks.exe
4392	schtasks.exe
4944	schtasks.exe
1560	schtasks.exe
5088	schtasks.exe
2712	schtasks.exe
3916	schtasks.exe
1592	schtasks.exe
452	schtasks.exe
4188	schtasks.exe
4100	schtasks.exe
788	schtasks.exe
952	schtasks.exe
4108	schtasks.exe
3512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
4676	powershell.exe
4676	powershell.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	5700	dllhost.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3764	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	154
PID 1880 wrote to memory of 3764	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	154
PID 1880 wrote to memory of 1192	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	155
PID 1880 wrote to memory of 1192	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	155
PID 1880 wrote to memory of 452	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	156
PID 1880 wrote to memory of 452	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	156
PID 1880 wrote to memory of 784	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	157
PID 1880 wrote to memory of 784	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	157
PID 1880 wrote to memory of 2716	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	158
PID 1880 wrote to memory of 2716	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	158
PID 1880 wrote to memory of 3116	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	159
PID 1880 wrote to memory of 3116	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	159
PID 1880 wrote to memory of 3548	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	160
PID 1880 wrote to memory of 3548	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	160
PID 1880 wrote to memory of 1860	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	161
PID 1880 wrote to memory of 1860	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	161
PID 1880 wrote to memory of 536	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	162
PID 1880 wrote to memory of 536	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	162
PID 1880 wrote to memory of 4676	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	163
PID 1880 wrote to memory of 4676	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	163
PID 1880 wrote to memory of 4936	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	164
PID 1880 wrote to memory of 4936	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	164
PID 1880 wrote to memory of 1128	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	165
PID 1880 wrote to memory of 1128	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	165
PID 1880 wrote to memory of 1648	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	166
PID 1880 wrote to memory of 1648	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	166
PID 1880 wrote to memory of 3504	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	167
PID 1880 wrote to memory of 3504	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	167
PID 1880 wrote to memory of 4844	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	168
PID 1880 wrote to memory of 4844	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	168
PID 1880 wrote to memory of 668	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	169
PID 1880 wrote to memory of 668	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	169
PID 1880 wrote to memory of 552	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	170
PID 1880 wrote to memory of 552	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	170
PID 1880 wrote to memory of 5028	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	171
PID 1880 wrote to memory of 5028	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	171
PID 1880 wrote to memory of 5052	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	172
PID 1880 wrote to memory of 5052	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	172
PID 1880 wrote to memory of 800	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	173
PID 1880 wrote to memory of 800	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	173
PID 1880 wrote to memory of 5700	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	194
PID 1880 wrote to memory of 5700	1880	180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe
"C:\Users\Admin\AppData\Local\Temp\180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:800
- C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe
  "C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\production\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\IdentityCRL\production\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellComponents\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\ShellComponents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\PrintHood\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\NetworkService\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\ModemLogs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Windows Portable Devices\csrss.exe
Size 1.9MB
SHA256 180102f846d452748fb47e8fddbf5ad057ce709e6d2b894ec3dbdea499dec98d
MD5 880b2950be17aca18aebdf116b26379b
SHA1 74c73e588de5a14a2c614c8a8d1f71c3e8ffdb54
SHA512 0c571f1e4ce7a3e887b55d7773453c910b3e2c5ee5eedf0d4a53a88d6b97f85114e8837794aa4ae6f2f600bdf5fde2374ffbc16b66bedcdda34379d530f3a967
SSDEEP 24576:ZcIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:3rhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe
Size 1.9MB
SHA256 eb0e9b09df4bb68b7710452b544a5537729ecce3bf7c1716dff334a3de196e95
MD5 aa3b4d540c90ae28b07deb9fc58b7d83
SHA1 af4f879d09bb7b43bef271e364349a7425d53bbb
SHA512 514220dd638686988420dd3050fbc2d195b871288cd16da8cb901217866e7301848156cbf266fa689fc2edbb41224d3a92f760efc7a86c7bb917b4ac07356a65
SSDEEP 24576:ZcIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:3rhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX838B.tmp

Path C:\Program Files\Windows Security\BrowserCore\en-US\RCX838B.tmp
Size 1.9MB
SHA256 e5ca00f77065358b7b0e50fcb154bd805f5df198ad0823ff7f587c78816e1097
MD5 ece82aec52eb295505ebfa67ef3ac1a6
SHA1 efcab146cdd0ba82e943f20e070e3ba5d2429394
SHA512 ab634f0f5e295c1d3f5dca6e40d0a3488d8db713dec91b857b91847959df1aa588c43b94f5df368f1d70192a4780bdfb5fd412319010d8ef4632525fd8669dd5
SSDEEP 24576:ZcIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:3rhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download